kernel.git/sound/core/pcm.c, branch linux-5.0.y

ALSA: pcm: Fix potential Spectre v1 vulnerability

2018-12-13T08:14:33Z

stream is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap) Fix this by sanitizing stream before using it to index pcm->streams Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai

ALSA: pcm: Use snd_pcm_stop_xrun() for xrun injection

2018-07-04T13:34:59Z

Basically the xrun injection routine can simply call the standard helper snd_pcm_stop_xrun(), but with one exception: it may be called even when the stream is closed. Make snd_pcm_stop_xrun() more robust and check the NULL runtime state, and simplify xrun injection code by calling it. Signed-off-by: Takashi Iwai

ALSA: pcm: trace XRUN event at injection, too

2018-07-04T13:34:57Z

The PCM xrun injection triggers directly snd_pcm_stop() without the standard xrun handler, hence it's not recorded on the event buffer. Ditto for snd_pcm_stop_xrun() call and SNDRV_PCM_IOCTL_XRUN ioctl. They are inconvenient from the debugging POV. Let's make them to trigger XRUN via the standard helper more consistently. Signed-off-by: Takashi Iwai

sound: Use octal not symbolic permissions

2018-05-28T09:27:20Z

Convert the S_ symbolic permissions to their octal equivalents as using octal and not symbolic permissions is preferred by many as more readable. see: https://lkml.org/lkml/2016/8/2/1945 Done with automated conversion via: $ ./scripts/checkpatch.pl -f --types=SYMBOLIC_PERMS --fix-inplace Miscellanea: o Wrapped one multi-line call to a single line Signed-off-by: Joe Perches Acked-by: Vinod Koul Signed-off-by: Takashi Iwai

ALSA: pcm: Fix UAF at PCM release via PCM timer access

2018-04-03T06:36:40Z

The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via substream->runtime, and it's cleared at snd_pcm_detach_substream(). The runtime object assignment is protected by PCM open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, as snd_pcm_timer_resolution() tries to access the runtime while clearing it in other side. Fortunately, it's the only concurrent access from the PCM timer, and it merely reads runtime->timer_resolution field. So, we can avoid the race by reordering kfree() and wrapping the substream->runtime clearance with the corresponding timer lock. Reported-by: syzbot+8e62ff4e07aa2ce87826@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai

ALSA: pcm: prevent UAF in snd_pcm_info

2017-12-05T22:28:08Z

When the device descriptor is closed, the `substream->runtime` pointer is freed. But another thread may be in the ioctl handler, case SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which calls snd_pcm_info() which accesses the now freed `substream->runtime`. Note: this fixes CVE-2017-0861 Signed-off-by: Robb Glasser Signed-off-by: Nick Desaulniers Cc: Signed-off-by: Takashi Iwai

ALSA: pcm: Forcibly stop at disconnect callback

2017-10-18T06:05:46Z

So far we assumed that each driver implements the hotplug PCM handling properly, e.g. dealing with the pending PCM stream at disconnect callback. But most codes don't care, and it eventually leaves the PCM stream inconsistent state when an abrupt disconnection like sysfs unbind happens. This patch is simple but a big-hammer solution: invoke snd_pcm_stop() at the common PCM disconnect callback always when the stream is running. Tested-by: Kuninori Morimoto Signed-off-by: Takashi Iwai

ALSA: pcm: Don't call register and disconnect callbacks for internal PCM

2017-10-18T06:05:34Z

The internal PCM (aka DPCM backend PCM) doesn't need any registration procedure, thus currently we bail out immediately at dev_register callback. Similarly, its counterpart, dev_disconnect callback, is superfluous for the internal PCM. For simplifying and avoiding the conflicting disconnect call for internal PCM objects, this patch drops dev_register and dev_disconnect callbacks for the internal ops. The only uncertain thing by this action is whether skipping the PCM state change to SNDRV_PCM_STATE_DISCONNECT for the internal PCM is mandatory. Looking through the current implementations, this doesn't look so, hence dropping the whole dev_disconnect would make more sense. Tested-by: Kuninori Morimoto Signed-off-by: Takashi Iwai

ALSA: pcm: Correct broken procfs set up

2017-08-24T22:05:16Z

The commit c8da9be4a75f ("ALSA: pcm: Adjust nine function calls together with a variable assignment") contained a badly incorrect conversion, a "status" PCM procfs creation was replaced with the next one. Luckily, this could be spotted easily by the kernel runtime warning. Fixes: c8da9be4a75f ("ALSA: pcm: Adjust nine function calls together...") Reported-by: Fabio Estevam Tested-by: Fabio Estevam Signed-off-by: Takashi Iwai

ALSA: pcm: Adjust nine function calls together with a variable assignment

2017-08-23T08:36:18Z

The script "checkpatch.pl" pointed information out like the following. ERROR: do not use assignment in if condition Thus fix the affected source code places. Signed-off-by: Markus Elfring Signed-off-by: Takashi Iwai